I should be noted that, occasional bilateral security arrangements
aside, MTA to MTA SMTP is generally vulnerable to MiTM attacks
regardless of whether RC4 is enabled or not.
With DANE, SMTP client MTAs can also authenticate servers for which
no prior security settings exist, and in *that* case we have a
fairly MiTM resistant protocol.
In Postfix for peers that publish TLSA RRs, the "mandatory" TLS
protocol, cipher and exclusion lists apply.
By all means, try:
smtp_tls_mandatory_protocols = !SSLv2, !SSLv3
smtp_tls_mandatory_exclude_ciphers = RC4
If there are any domains that publish TLSA records for an SMTP
server that is capable only of legacy crypto, both they and I will
be surprised.
--
Viktor.